CVE-2024-49705

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to client-side Denial of Servise (DoS) attacks. An attacker might trick a user into using an URL with a d parameter set to an unhandled value. All the subsequent requests will not be accepted as the server returns an error message. Since this parameter is sent as part of a session cookie, the issue persists until the session expires or the user deletes cookies manually. Similar effect might be achieved when a user tries to change platform language to an unimplemented one. This vulnerability has been patched in version 79.0

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248

Affected software

No affected versions have been published.

Timeline

Published: Apr 14, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-497066.1Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Open Redirect attacks by including base64 encoded URLs in the targ CVE-2024-497076.1Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might tr CVE-2024-497085.4Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Stored XSS (Cross-site Scripting) attacks. An attacker might trick CVE-2024-497094.4Internet Starter, one of SoftCOM iKSORIS system modules, allows for setting an arbitrary session cookie value. An attacker with an access to CVE-2024-49715.4The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all ver CVE-2024-497147.8In avrc_vendor_msg of avrc_opt.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to paired device e CVE-2024-49729.8A vulnerability classified as critical has been found in code-projects Simple Chat System 1.0. This affects an unknown part of the file /log CVE-2024-497207.8In multiple functions of Permissions.java, there is a possible way to override the state of the user's location permissions due to a logic e CVE-2024-497225.5In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy. This could lead to CVE-2024-497247.0In multiple functions of AccountManagerService.java, there is a possible way to bypass permissions and launch protected activities due to a CVE-2024-497285.5In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy. This could l CVE-2024-49739.8A vulnerability classified as critical was found in code-projects Simple Chat System 1.0. This vulnerability affects unknown code of the fil